# Can i assign a kibana role to an openid realm based user through API

**URL:** <https://discuss.elastic.co/t/can-i-assign-a-kibana-role-to-an-openid-realm-based-user-through-api/203838>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [October 16, 2019, 12:49pm UTC](https://discuss.elastic.co/t/can-i-assign-a-kibana-role-to-an-openid-realm-based-user-through-api/203838 "2019-10-16T12:49:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![soumendra](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@soumendra](https://discuss.elastic.co/u/soumendra)\
**Post date:** [October 16, 2019, 12:49pm UTC](https://discuss.elastic.co/t/can-i-assign-a-kibana-role-to-an-openid-realm-based-user-through-api/203838/1 "2019-10-16T12:49:05Z")

</div>

I have created a Role with the help of the following documentation in Kibana.  
Links:  
[https://www.elastic.co/guide/en/kibana/7.3/role-management-api-put.html](https://www.elastic.co/guide/en/kibana/7.3/role-management-api-put.html)  
[https://www.elastic.co/guide/en/kibana/7.3/kibana-privileges.html](https://www.elastic.co/guide/en/kibana/7.3/kibana-privileges.html)

However, I am unable to assign this role to a user created with OpenID based realm. Is there any way to do this?  
API used to create the `developer` role:  
URL:  
`PUT {{kb_ip_port}}/api/security/role/developer_role`

```
{
	"metadata": {
		"version": 1.0
	},
    "elasticsearch": {
        "cluster": [
            "monitor",
            "manage_index_templates",
            "manage_pipeline",
            "manage_ingest_pipelines",
            "transport_client",
            "manage_ml",
            "monitor_ml",
            "manage_data_frame_transforms",
            "monitor_data_frame_transforms",
            "manage_watcher",
            "monitor_watcher",
            "manage_ccr",
            "manage_ilm",
            "read_ilm",
            "manage_rollup",
            "monitor_rollup",
            "manage_saml",
            "manage_token",
            "create_snapshot",
            "manage_oidc",
            "read_ccr",
            "manage"
        ],
        "indices": [
            {
                "names": [
                    "*"
                ],
                "privileges": [
                    "all"
                ]
            }
        ]
    },
    "kibana": [
        {
            "base": [
                "all"
            ],
            "feature": {},
            "spaces": [
                "*"
            ]
        }
    ]
}
```

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 16, 2019, 12:59pm UTC](https://discuss.elastic.co/t/can-i-assign-a-kibana-role-to-an-openid-realm-based-user-through-api/203838/2 "2019-10-16T12:59:58Z")

</div>

Hi there,

You can assign roles to the users that log in with OpenID Connect with [role mapping](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/oidc-role-mapping.html) based on various OpenID Connect claims

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2019, 1:00pm UTC](https://discuss.elastic.co/t/can-i-assign-a-kibana-role-to-an-openid-realm-based-user-through-api/203838/3 "2019-11-13T13:00:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.